Knowledge Management

kv_store vs dbxlookup


Hi splunkers!

Need your advice again.
We have a db table with users registrations. Millions of entries. There's an option for a user to merge with another account if for some reason he created another one. Merge happens pretty often. But there's no earliest date of registration for merged users in original table. So we address to another table where this info is stored. Make lookup of it and then make kv_store lookup of original table taking in consideration merged accounts lookup.

This kvstore lookup is used to correctly segment users' purchases, logins by their registration date.
Rewriting of this kv_store lookup takes hours and sometimes it skips..
Now we want to create outside splunk separate db table with correct registration information and to use it queries.

And here's a question: which way is better to use in this case?

  1. Dbxlookup without need to update something in splunk
  2. kv-store lookup with its complete rewriting several times a day
  3. kv-store lookup updating it values through REST API ?
Labels (1)
0 Karma
Get Updates on the Splunk Community!

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...